PRIVACY POLICY

1. Introduction

This Privacy Policy describes how Memorix ("we," "us," or the "App") collects, uses, stores, shares, and protects the personal data of users ("you" or "User") of our flashcard and deck-based study and memorization app, made available through Google Play and, in the future, other app stores.

This Policy has been prepared in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — "LGPD"), and, considering that Memorix may be used by people located outside Brazil, it also observes, on a complementary basis, the principles of the European Union's General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR"), where applicable.

By creating an account or using Memorix, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. If you do not agree with any part of this Policy, we recommend that you do not use the App.

2. Who we are — data controller

For the purposes of the LGPD and the GDPR, the controller of personal data processed through Memorix is BRUNO GONÇALVES LEITE BONECKER DOS SANTOS, registered under CNPJ/CPF No. 054.468.987-96, with address at RUA CAROLINA SANTOS 119, hereinafter referred to as "Memorix."

If you have questions about this Policy or about the processing of your personal data, please contact us at PRIVACY@MEMORIXAPP.COM, as detailed in Section 17 of this Policy.

3. Definitions

To make this Policy easier to understand, the following terms have the meanings set out below:

Personal data: any information relating to an identified or identifiable natural person.

Data subject: the natural person to whom the personal data being processed relates (you, the Memorix User).

Controller: the party responsible for decisions regarding the processing of personal data (Memorix).

Processor: the party that processes personal data on behalf of the controller (for example, Base44 and other infrastructure providers used by Memorix).

Processing: any operation carried out with personal data, such as collection, storage, use, sharing, or deletion.

Base44: the no-code development platform used to build and host Memorix, responsible for part of the App's technical infrastructure, including native user authentication.

4. Data we collect

4.1. Data you provide directly

When you create a Memorix account, we collect the email address and password you choose. We may also collect a username or nickname, if the App allows you to set one.

4.2. Authentication data

Memorix uses the native authentication system of the Base44 platform to manage user logins. This means your access credentials (email and password) are processed and stored in encrypted form by Base44's authentication infrastructure, and are not stored in readable form or directly accessed by Memorix's developers. Memorix only receives confirmation that authentication was successful and the minimum information needed to identify your account (such as the associated email address).

4.3. Usage data and user-generated content

We collect the data you generate while using the App, such as the decks and flashcards you create, your study history and progress, performance statistics (for example, cards reviewed, accuracy rate, study streak), and your App configuration preferences.

4.4. Technical and device data

We may automatically collect technical information about the device used to access Memorix, such as device model, operating system and version, device identifiers, configured language, performance data, and crash reports, for the purpose of ensuring the App functions properly and securely.

4.5. Data we do not collect

By default, Memorix does not collect sensitive personal data as defined under Article 5, II of the LGPD (such as racial or ethnic origin, religious belief, political opinion, health or sex life data, or genetic or biometric data), unless you, on your own initiative, include this type of information in the content of the flashcards you create — in which case the responsibility for including such data rests solely with you. Memorix does not request or require this type of data for the App to function.

In the case of paid services, such as a Premium version or subscription, payments may be processed by third-party payment providers, including Google Play Billing and other payment services that may be made available in the future. Memorix does not store full credit card details.

5. How and why we use your data

We use the personal data collected for the following purposes:

1. (a) To create, maintain, and authenticate your Memorix user account;
2. (b) To enable the creation, storage, synchronization, and display of your decks and flashcards;
3. (c) To personalize your study experience, including spaced-repetition algorithms and progress statistics;
4. (d) To ensure the security, stability, and proper technical functioning of the App, including fraud prevention and misuse detection;
5. (e) To communicate with you about updates, important notices, or changes to this Policy and the Terms of Use;
6. (f) To comply with applicable legal or regulatory obligations;
7. (g) To analyze aggregated App usage metrics in order to improve existing features and develop new ones.

We do not use your personal data to sell it to third parties, nor for advertising purposes that involve sharing the content of your flashcards with advertisers.

6. Legal basis for processing

Memorix's processing of personal data is based on the following legal bases set out in Article 7 of the LGPD (and, where applicable to users in the European Union, Article 6 of the GDPR):

Performance of a contract: the processing of account and authentication data is necessary to provide the service you requested by creating a Memorix account.

Consent: where required, particularly for sending non-essential communications or using certain tracking technologies (non-essential cookies), processing is based on your free, informed, and unambiguous consent, which may be withdrawn at any time.

Legitimate interest: we use usage and technical performance data based on our legitimate interest in maintaining, protecting, and improving the App, always respecting your fundamental rights and freedoms, and without prejudice to your right to object.

Compliance with a legal or regulatory obligation: when necessary to meet legal, judicial, or competent authority requirements.

7. Sharing of data with third parties

Memorix may use third-party service providers to understand how the App is used, monitor technical performance, identify errors or crashes, measure the effectiveness of its own marketing campaigns, and promote the Memorix App through external advertising platforms.

Memorix may share personal data with the following processors and categories of third parties, strictly to the extent necessary to provide the service:

Base44: the technology platform used for hosting, infrastructure, and authentication of the App, acting as a data processor on behalf of Memorix.

Google Play / Google LLC: as the App's distributor, Google may process certain technical data related to the installation, update, and performance of the App, in accordance with its own privacy policies.

Any analytics, crash-reporting, attribution, or advertising tools actually integrated into the App or used in connection with Memorix’s marketing activities will be specifically identified and kept up to date in this Privacy Policy, where required; e.g., Google Analytics for Firebase, Firebase Crashlytics, Google Ads, Meta Ads, TikTok Ads, or other analytics, attribution, or advertising platforms.

Public authorities: we may share personal data when required by law, court order, or a request from a competent authority.

We do not share, sell, rent, or otherwise commercialize your personal data with third parties for marketing or third-party advertising purposes.

All processors with whom we share personal data are contractually required to implement security measures compatible with the LGPD and to process data solely for the purposes authorized by Memorix.

8. International data transfers

Although Memorix is operated from Brazil, the App may be used by people located in other countries, and the servers of the infrastructure used (Base44 and other providers) may be located outside Brazilian territory.

In such cases, Memorix adopts appropriate measures to ensure that any international transfer of personal data complies with the requirements of Article 33 of the LGPD, including verifying that the destination country or international organization provides an adequate level of data protection, or that appropriate contractual safeguards are in place with the processors involved.

For users located in the European Economic Area, Memorix seeks to observe, to the extent applicable, the international transfer mechanisms provided for under the GDPR, such as standard contractual clauses.

9. Data retention and deletion

Your personal data will be retained for as long as your account remains active, or for as long as necessary to fulfill the purposes described in this Policy, subject to any applicable legal retention obligations.

You may request the deletion of your account and associated personal data at any time, by request to the contact email listed in Section 17. We retain personal data only for as long as necessary to provide the Service and fulfill the purposes described in this Policy.

If you delete your account:

• personal information will be deleted or anonymized within a reasonable period, except where retention is required by law;
• backup copies may remain temporarily until securely overwritten;
• publicly shared community content may remain available if necessary to preserve discussion integrity, although it may be anonymized where appropriate.

10. Information security

Memorix adopts reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, destruction, or any other form of inadequate or unlawful processing, including the encryption of access credentials by Base44's authentication infrastructure and restricted access controls over stored data.

Despite these efforts, no information security system is entirely infallible. Should a security incident occur that may pose a relevant risk or harm to data subjects, Memorix will notify the Brazilian National Data Protection Authority (ANPD) and affected data subjects, as required under Article 48 of the LGPD, and will take appropriate measures to reverse or mitigate the effects of the incident.

11. Your rights as a data subject

Under Article 18 of the LGPD, you have the right to:

1. (a) confirmation of the existence of processing of your personal data;
2. (b) access to your personal data;
3. (c) correction of incomplete, inaccurate, or outdated data;
4. (d) anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
5. (e) portability of your data to another service provider, upon express request;
6. (f) deletion of personal data processed on the basis of your consent;
7. (g) information about the public and private entities with which Memorix has shared your data;
8. (h) information about the possibility of not providing consent and the consequences of doing so;
9. (i) withdrawal of consent, at any time;
10. (j) objection to processing carried out on a legal basis other than consent, where you believe the LGPD has not been complied with.

To exercise any of these rights, please contact us at the email listed in Section 17 of this Policy. We will respond to your request within the timeframes established by applicable law.

12. Use by children and teenagers

Memorix is an educational app that may be of interest to students who are minors. We recognize the importance of additional protection for the personal data of children and teenagers, under Article 14 of the LGPD.

If the App is used by children (under 12 years of age, as defined by Brazil's Statute of the Child and Adolescent), the processing of personal data will require the specific and prominent consent of at least one parent or legal guardian.

Teenagers (between 12 and 17 years of age) may use the App with due regard for the minor's best interests, and parental or guardian guidance and supervision regarding the use of digital applications in general is recommended.

If a parent or legal guardian becomes aware that a child has provided personal data to Memorix without proper consent, they may request the deletion of that data through the contact channel listed in Section 17 of this Policy.

13. Cookies and tracking technologies

Should Memorix launch a web version or use tracking technologies within the mobile app (such as advertising identifiers or behavioral analytics tools), such technologies will be specifically described and kept up to date in this section, including their purposes and how to manage your preferences.

14. Links to third-party sites and services

Memorix may contain links to third-party sites, services, or applications. This Privacy Policy applies solely to Memorix and we are not responsible for the privacy practices adopted by third parties. We recommend that you read the privacy policies of any third-party site or service you access from Memorix.

15. Changes to this privacy policy

This privacy policy may be updated periodically to reflect changes in our data processing practices, new App features, or changes in applicable law. The current version will always be available within the App and/or on our official distribution channel.

Material changes will be communicated to you with reasonable advance notice, through a notice within the App or by email, whenever required by law. Continued use of Memorix after such changes take effect constitutes your acceptance of the new terms.

16. Google Play data safety

The information provided in this Privacy Policy is intended to be consistent with the disclosures made through the Google Play Data Safety section. In the event of any inconsistency, the disclosures submitted through Google Play shall be interpreted together with this Privacy Policy.

17. Data Protection Officer (DPO) and contact channel

To exercise your rights as a data subject, clarify questions about this Policy, or report any concern related to privacy and personal data protection at Memorix, please contact us at: PRIVACY@MEMORIXAPP.COM

18. Governing law and jurisdiction

This Privacy Policy is governed by the laws of the Federative Republic of Brazil, in particular the General Data Protection Law (Law No. 13,709/2018) and the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).

The courts of RIO DE JANEIRO / RJ are elected to settle any disputes arising from this Policy, with express waiver of any other, however privileged, except for cases of mandatory jurisdiction provided for by law, such as those relating to consumer protection.